RFC6331: Moving DIGEST-MD5 to Historic

[Neustradamus]

Dear @ruby team,

In first, I wish you a Happy New Year!

20 November 2008: CRAM-MD5 to Historic:

• https://tools.ietf.org/html/draft-ietf-sasl-crammd5-to-historic-00

29 June 2017: CRAM-MD5 to Historic:

• https://tools.ietf.org/html/draft-zeilenga-luis140219-crammd5-to-historic-00

July 2011: RFC6331: Moving DIGEST-MD5 to Historic:

• https://tools.ietf.org/html/rfc6331

August 2021: RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2:
"Replaced DIGEST-MD5 SASL mechanism with SCRAM-SHA-256. DIGEST-MD5 was deprecated."

• https://tools.ietf.org/html/rfc9051

I add same about SCRAM-MD5.

There are now:

• July 2010: RFC5802: Salted Challenge Response Authentication Mechanism (SCRAM): SASL and GSS-API Mechanisms: https://tools.ietf.org/html/rfc5802 (SCRAM-SHA-1 and SCRAM-SHA-1-PLUS)
• July 2010: RFC5803: Lightweight Directory Access Protocol (LDAP) Schema for Storing Salted: Challenge Response Authentication Mechanism (SCRAM) Secrets: https://tools.ietf.org/html/rfc5803
• November 2015: RFC7677: SCRAM-SHA-256 and SCRAM-SHA-256-PLUS: Simple Authentication and Security Layer (SASL) Mechanisms: https://tools.ietf.org/html/rfc7677

Soon:

• SCRAM-SHA-512(-PLUS): https://tools.ietf.org/html/draft-melnikov-scram-sha-512
• SCRAM-SHA3-512(-PLUS): https://tools.ietf.org/html/draft-melnikov-scram-sha3-512

[hsbt]

@nevans Should we remove MD5 authenticate and add SASL or other modern mechanism same as ruby/net-imap#62? I don't have enough knowledge for POP3 protocol.

[nevans]

@hsbt I haven't had any experience with POP3 since the late 1990's. 😉 Quickly skimming the POP3 RFCs, it looks like APOP is part of the core POP3 specification, and APOP requires an MD5 digest. Because it's part of the core spec, we probably shouldn't remove it. Printing a warning like ruby/net-imap#62 is probably the right thing to do.

IMO, even more important is following RFC-7817 and RFC-8314 and 1) defaulting to use TLS (or STARTSSL), 2) ensure the server is verified correctly, and 3) print warnings or require a special allow_insecure_cleartext: true whenever a connection attempts to authenticate without using TLS (or STARTSSL).

POP3 does have a SASL extension RFC-5034, but it looks like net-pop doesn't support it yet? It looks like net-pop is also missing the CAPA command? But I think that should be a relatively easy addition. IMO, net-imap, net-pop, and net-smtp should all share a single SASL implementation. That's kind of the entire point of SASL! 😉 That could either mean adding dependencies from net-pop and net-smtp to net-imap, or extracting Net::IMAP::SASL/Net::IMAP::*Authenticator* to a new gem that all three depend on.